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INTRODUCTION 



The 5-Volt only E 2 PROM brought to the digital design 
industry a remarkably versatile memory device which, for 
the first time, merged the in-system alterability charac- 
teristics and design ease of static RAMs with the 
nonvolatile storage characteristics of ROMs and PROMs. 
This innovation provided a simple and reliable solution 
to many system designs and subsequently became one 
of the most desirable memory elements in the industry. 

Along with this amazing invention came a subtle system 
hazard known as "inadvertent" or "false" writes. Inadver- 
tent writes were, at first, often falsely interpreted as a 
random data change within the memory itself. This 
intimidated many interested system designers into 
disregarding E 2 PROM technology and settling for inferior 
and often more costly memory solutions. Upon closer 
inspection, the actual cause was revealed to be valid 
write commands which were inadvertently issued to the 
E 2 PROM during system power transitions, brownouts, 
and power line "hiccups". Initially, E 2 PROM manufacturers 
suggested support circuitry to protect their memories from 
these system indiscretions. More recent IC designs have 
moved this protection onto the chip itself, eliminating the 
problem of inadvertent write hazards and, finally, 
providing safe and reliable electrically alterable nonvolatile 
memory devices. 



System designs utilizing E 2 PROMs vary dramatically in 
both implementation and nature. Consequently, these 
systems are optimally supported by an equivalent variety 
of false write protection mechanisms. Some cost-critical 
designs are best served by inexpensive E 2 PROM devices 
(e.g., XL2816A) coupled with simple external protection 
circuitry. Other design engineers utilize a sound 
understanding of the false write hazard combined with 
the thorough on-chip protection mechanisms. Leading 
edge designs incorporate EXEL's state-of-the-art 
E 2 PROMs, with their fully integrated inadvertent write 
protection, to achieve exceptionally efficient solutions. 
Whatever your design specifications may be, EXEL offers 
an E 2 PROM solution which eliminates the problem of 
inadvertent hazards and provides ROM-like data 
confidence. 



This applications note will describe the nature and source 
of inadvertent data alteration as it applies to E 2 PR0M 
technology as well as describing the variety of protection 
mechanisms designed into the memory chips themselves. 
Also, an assortment of external solutions will be 
discussed along with the specific applications which they 
best support. 

Inadvertent write hazards can easily be eliminated as a 
system concern through an understanding of the true 
nature of the problem combined with some design 
foresight. In many existing systems, sporadic false writes 
may be curtailed by simply replacing competitor's 
E 2 PROM devices with the write-protection-enhanced 
EXEL equivalents. 
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THE SOURCE OF INADVERTENT WRITES 

The evolutionary tree in Figure 1 shows the progressive 
development of nonvolatile memory toward easy 
alterability. Eventually, this lineage merged with the static 
RAM to provide the best attributes of each memory type 
in a single device. Today's fully featured E 2 PROMs offer 
secure zero-power data retention characteristics 
combined with an easily interfaced RAM-like writability. 
This highly flexible memory type, due to its dual nature, 
is susceptible to the hazard of inadvertent write 
commands which may be issued to it by the system 
control bus during the system power transitions. 




DIP SWITCH POTENTIOMETER 



Figure 1. Nonvolatile Memory Evolution Chain 



Digital Garbage 

Chip designers who have developed logic devices, 
microprocessors and controllers have never concerned 
themselves with what their devices spit onto the bus 
during system power transitions. Formerly, this did not 
present a problem since nonvolatile memory types were 
not alterable in system and the volatile memories (RAMs) 
lost all data after power down and were initialized after 
the system stabilized following the power-on sequence. 
Clearly, even if write commands were inadvertently 
generated during these system power transitions, no 
critical data alteration would occur. 

Indiscrete System Commands 

Fully automated (internally latched and timed) E 2 PROMs 
can recognize write commands which, although logically 
valid, are actually the result of noise spikes, glitches and 
bus contention occurring in the system while the power 
supply is transitioning. These signals may erroneously 
initiate nonvolatile write cycles in the E 2 PROM causing 
garbage on both the address and data buses to be 
internally latched. Subsequently this data may be written 
into the nonvolatile memory array. Once it's clear that 
the source of inadvertent data changes exists external 
to the E 2 PROM, a wide variety of possible protection 
mechanisms are brought forth as feasible, practical 
solutions. 



ON-CHIP PROTECTION MECHANISMS 

As the evolutionary trend to integrate the E 2 PROM 
support circuitry onto the memory chip itself has 
continued, protection features have become a part of the 
accepted E 2 PROM norm. EXEL design engineers have 
developed and integrated a variety of mechanisms which 
protect the E 2 PROM data integrity throughout power 
transitions, brownouts and system noise bursts. 

These features include: 

• WE Noise Filter 

• V cc Lockout Circuitry 

• Power-up Write Delay 

• Software Write Enable Control 

Through the informed utilization of these advanced 
features, the system engineer can quickly eliminate 
concern about his E 2 PROM data integrity and return his 
attention to an exploration of the power and versatility 
that EXEL E 2 PROMs offer to the system design. 
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WE Noise Filter 

The WE noise filter is a very basic protection scheme 
incorporated in all EXEL NMOS memories, which blocks 
common "glitches" and short duration noise spikes from 
initiating a nonvolatile write cycle. This feature is active 
during both power transitions an d du ring normal opera- 
tion. Figure 2a shows the range of WE pulse widths and 
their influence on the XL2816A. This filter mechanism 
is achieved through the use of an internal capacitor 
(Cfilter) from the WE input to (V ss ) which must be 
charged and discharged throu gh t he input protection 
resistance (R P ) and the system WE connections. Figure 
2b shows a model of the WE input filter. 



Although the data sheet specification requires a minimum 
WE pulse width (t WP ), the internal write cycle can be 
initiated with a pulse of shorter duration than that. For 
example, assuming CE and OE are a t appropriate levels, 
supplying the XL2816A with a WE pulse of >150 
nanoseconds is guaranteed to initiate a nonvolatile write 
cycle. A shorter WE pulse may, however, also initiate a 
writ e cy cle. This is just not guaranteed. The purpose of 
the WE noise filter is, therefore, to eliminate glitches and 
noise as a potential source of inadvertent write cycles. 
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V cc Lockout Mechanism 

The V C c Lockout mechanism is the most technologically 
sophisticated protection mechanism offered on E PROMs 
today. It is a fully integrated automatic function. It 
operates transparently to, and without intervention from, 
the system and can effectively eliminate power transition 
related inadvertent write cycles. 



system generated, E 2 PROM write commands increases 
dramatically. The function of the V cc lockout mechanism 
is to monitor the applied V cc level and inhibit any 
E 2 PROM write commands coincident with V cc « V W |. In 
other words, this circuit watches the supply voltage and 
disables the internal write circuitry any time that V C c drops 
below a specif ied threshold voltage (V W |). A model of this 
function is shown in Figure 4. 



INADVERTENT WRITE 
SAFETY REGION 



DANGER ZONE 



DANGER ZONE 



Figure 3a. NMOS/TTL Systems 
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Figure 3b. CMOS Systems 



Figure 3. Danger Region Graphs 
How It Works 

The danger region graphs (Figures 3a and 3b) show the 
system V cc ranges in which the probability of unintended, 



The V cc level below which write cycles are inhibited is 
specified in the DC Operating Characteristics section of 
the device data sheet. This trip point is defined as a 
voltage range instead of a constant level to account for 
manufacturing variations and changes in thresholds as 
the device temperature varies throughout its allowable 
range. The XL2816A, for example, specifies a range 
between 3.0 V and 3.5 V within which the V W | trip point 
will vary. This range normally provides sufficient 
protection when the system is implemented using CMOS 
components since these usually offer responsible logic 
down to V cc = 2.5 V. However, if NMOS or bipolar 
logic is utilized, then additional precaution is advised 
since their outputs often become sporadic when V cc is 
below 3.8 V. 

The V cc lockout voltage (V W i) on the XL281 7A, XL2864A, 
XL2865A and XL28C256 is specified as a window from 
4.0 V to 4.5 V (to 4.4 V on the XL281 7A). This range is 
high enough to block even the indiscriminate signals of 
NMOS and bipolar systems. Referring again to the 
danger region graphs (Figures 3a and 3b), it is clear that 
by blocking write commands when V cc is below 4.0 V, 
the primary hazards of system generated inadvertent 
write cycles are eliminated. 
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Figure 4. V cc Lockout Circuit Model 
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Hysteresis 

A small hysteresis region is designed about the V W | 
threshold to eliminate possible oscillations and to simplify 
the management of brief V cc dips (brownouts). The 
XL2864A and XL2865A, for example, display the follow- 
ing characteristics: 

When V C c is rising from a level below V Wh these 
devices will wait a maximum of 50 |xs before recognizing 
write commands. 

When V C c is falling from a level greater than V WI , 
these devices will initially assume that a brownout is 
occurring and so remain fully operational for 50 ns after 
the V w , threshold is crossed. If the V cc level returns to 
or above V w , within 50 ns, then the device does not 
evoke the internal write inhibition features. After 50 ns 
has passed, if V cc is still less than V W |, then the write 
lockout feature is activated, write commands are ignored 
and any nonvolatile write cycle in progress will be aborted. 

Limitations of the V cc Lockout 

The V C c lockout mechanism eliminates the hazards of 
inadvertent data alterations in most system designs. It is, 
however, possible to circumvent this protection through 



unusual system designs. A system requirement when 
relying on the on-chip V C c sensor is that the same supply 
voltage powers all of the components which can drive 
the control bus. 

In a system with multiple power supplies (see Figure 5), 
the possibility exists that the power supply of a device 
driving the control bus (Power Supply B) could falter 
without affecting the power supply which operates the 
E 2 PROM (Power Supply A). In this case, inadvertent 
write signals issued on the control bus would not be 
blocked by the V cc lockout mechanism since the V cc 
lockout circuit would be monitoring an operational level 
supply voltage. 

A second way to thwart the V cc lockout mechanism is 
through the use of components whose outputs become 
unstable or erratic at supply voltages above 4.0 V. If a 
system is designed, for instance, with components limited 
to a 5% variation in V C c and if those components are 
capable of asserting indiscriminate signals on the control 
bus when V C c is above 4.0 V, then an alternate method 
of protection is recommended. The ideal solution is the 
on-chip software controlled write protection offered on 
the XL28C256. Other EXEL E 2 PROMs could be 
protected through external means (see the External 
Design Solutions section). 
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Figure 5. Multiple Power Supplies (Example) 
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XL2816A Power-Up Delay 

The XL2816A has one inadvertent write protection 
mechanism which is unique amongst the E 2 PROM 
products. This feature is called the POWER UP DELAY 
mechanism and effectively blocks any write commands 
issued to the E 2 PROM during and immediately after 
power-up. Its purpose is to allow the system to stabilize 
the control bus before allowing the memory to respond 
to write commands. Note that this delay mechanism does 
not affect E 2 PROM read commands. 

Most inadvertent data alterations occur during the 
power-up phase of system power transitions. This is 
primarily due to the fact that any write cycles which are 
initiated during the power-up phase have plenty of time 
to complete whereas those initiated as power falls away 
are often disabled by lack of power before any nonvolatile 
data alteration actually occurs. While V cc is on the way 
up between V W( and the voltage at which the system 
operates reliably, transient signals might combine to 
assert a valid write command. The power-up delay func- 
tion on the XL281 6A eliminates this hazard by ensuring 
that 5-20 ms elapse after V cc reaches V W! before 
nonvolatile write cycles are enabled (see Figure 6). 
This feature is offered only on the XL2816A since the 
ensuing E 2 PROMs incorporate a V W! within the range of 
4.0-4.5 V. This higher write inhibit threshold window 
essentially eliminates the inadvertent write hazard 
without the need for the additional power-up delay 
protection. 

The power-up delay feature can often eliminate bother- 
some write hazards by merely replacing another 
manufacturer's 281 6A device in an existing design. When 



inadvertent data alterations are occurring during the 
power-up transition, the enhanced XL2816A will often 
curtail the problem without further board revisions. 

Although the power-up delay enhancement, when com- 
bined with the other standard XL2816A protection 
features, will eliminate most system write hazards, it may 
not constitute a complete and reliable solution in all 
applications. Take, for example, a system which has such 
great capacitance on the supply rail that the power down 
period, as V cc falls from 4.0 V to 3.0 V, is 1 00 ms. Such 
a system could perform multiple nonvolatile write cycles 
in a single power down cycle. To handle this peril the 
power-down period could be sharply reduced by shorting 
the V cc rail capacitance to ground upon power loss. 
Combining the XL2816A's power-up delay feature with 
a short (<200|xs) power down period is a simple way to 
shut out power transition related inadvertent writes. 

Note: In the unlikely event of a power crash during a 
nonvolatile write cycle, the content of the byte currently 
being operated upon will be indeterminate. 



XL28C256 Write Enable/Disable Control 

The most powerful on-chip inadvertent write protection 
available today is the write enable register featured on 
the XL28C256. This is a software controlled register 
which allows the system to control the memory device's 
ability to respond to system generated write commands. 

With the special software write control feature set, the 
XL28C256 powers up with its on-board high voltage 
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Figure 6. XL2816A Protection Scheme 
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generator disabled, which essentially renders the device 
a ROM. When E 2 PROM data alteration is desired, a 
software procedure is performed by the system which 
places the XL28C256 into a write enabled mode. When 
the write sequence is completed, the device is simply 
returned to its ROM mode. Unexpected brownouts or 
system crashes will, therefore, be unable to generate 
unintentional data changes. This feature is described in 
detail in the XL28C256 data sheet. 



Logic Certain Control Conditions 

Each of EXEL's RAM-like E 2 PROMs requires a unique 
control pin combination which includes WE, CE, and OE 
in order to initiate a nonvolatile write cycle. 

NV WRITE CYCLE INITIATION = CE • WE • OE • (protection conditions met) 

(Equation 1) 

Therefore, inadvertent write hazards will be circumvented 
by violating any one of these write conditions during 
system power transitions. This may be accomplished by 
holding either CE or WE up near V cc or by "bootstrapping" 
OE to the ground rail. Since V cc is changing during 
system power-up and power-down, the best solution is 
to hold OE at V ss during perilous periods. Several simple 
circuits which perform this function will be discussed in 
the following sections. 



On-Chip Protection Summary 

Many useful features have been designed into EXEL's 
E 2 PROM products to eliminate the hazards of inadvertent 
data alteration. Each of these features addresses a 
particular aspect of the inadvertent write problem. 
By choosing the proper E 2 PROM device for a given 
application, the on-chip protection mechanisms will 
combine to shut out unintentional data changes (see 
Table 1 ). When redundant protection is desired, or when 
cost considerations override on-chip protection values, 
then external protection circuitry may be utilized to protect 
the nonvolatile data. This is the subject of the next section. 



OFF-CHIP WRITE PROTECTION CIRCUITS 

In some applications it is desirable to implement external 
power-up/down protection to enhance data security and 
prevent unusual conditions from risking the data integrity. 
EXEL E 2 PROMs are designed to accommodate external 
protection schemes, and some of the simple protection 
circuit solutions are discussed in this section. The 
fundamental principle is that inadvertent write signals 
which occur on the control bus may be blocked from the 
E 2 PROM by managing one of its control lines and 
violating the write condition when hazardous conditions 
exist. The primary concern is during power-up and 
power-down periods. 
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Table 1. On-Chip Protection Features 
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Since both CE and WE must be low in order to initiate 
a nonvolatile write cycle (refer to Equation 1), holding 
either one of these signals to the V cc rail will render the 
E 2 PROM ROM-like. Likewise, since the OE pin must be 
held high to initiate a write cycle, then holding it to the 
ground rail will also inhibit write commands from initiating 
a nonvolatile write cycle (see Table 2). 

This, consequently, results in two basic approaches to 
external inadvertent write protection designs: 
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Table 2. 



An example of Hold High Protection is shown in Figure 
7a. This is a simple and inexpensive approach to 
eliminating unauthorized data changes. The switch may 
be a DIP switch mounted inside the machine available 
only to service personnel, a security lock-type switch 
(Figure 7b) or a contact made upon insertion of a 
programming cable (Figure 7c). 



Wit h the switch open during normal system operation, 
the WE pin is held high via R P , eliminating the chance 
of data alterations. When service personnel want to 
update the firmware, they simply close the switch, giving 
the system full access to the E 2 PROM's RAM-like 
interface. 
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Figure 7c. 
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A second example is shown in Figure 8. This software 
controlled switch performs the same function as the 
hardware switch, yet it allows for software access and 
control. In this application, it is important to restrict the 
latch to a CMOS type, which will provide responsible 
outputs to V cc levels below 3.0 V. During power-up, t he 
RC circuit holds the SET input low to ensure that WE 
stays high. The address and data AND gates ensure that 
only a specific and unique address/data combination will 
provide a logic "0" to the D-latch input. The control AND 
gate clocks the data into the latch only when a system 
write cycle is directed to the latch. Upon this combination 
of events, the E 2 PROM WE pin is set low and data may 
be altered through write cycles in which bytes are clocked 
in using the CE control pin. Once the E 2 PROM data has 
been updated, the latch is reset to a logic "1" and the 
E 2 PROM becomes ROM-like once again. 



Fully Automatic Power Transition Protection 

The V cc lockout mechanism described previously in the 
On-Chip Protection Mechanisms section is easily 
implemented externally, allowing the designer to set the 
V w , trip point at any level desired. For example, a high 
precision machine might utilize many V cc ±5% compo- 
nents and consequently a V W | threshold set at 4.75 V 



would provide more security than the on-chip 4.0 V 
threshold. This may be accomplished by using one of the 
Intersil Programmable Voltage Reference options. 

Intersil ICL8211 ICL7665 Solutions 

Figure 9a shows the implementation of the Intersil 
ICL821 1 to provide external V cc monitoring and 
inadvertent write control. R-i and R 2 are selected 
according to a formula supplied in the ICL821 1 data sheet 
to provide the desired V W | threshold voltage. The 
ICL821 1 monitors the applied supply voltage level and 
when it drops below the V W! defined by R, and_R 2 . its 
open collector output pin turns on, pulling the OE line 
low, thereby violating the necessary write condition. 
Consequently, any time that the supply voltage is below 
the specified level, write commands present on the 
control bus will be suppressed. Figure 9b shows the 
relationship between V cc and V OU t as the system turns 
on and then off again. Since the output driver of the 
ICL821 1 is an open collector device, _any other open 
collector driver may be used to control OE during normal 
system operation. 

Note: V OUT rises when V cc is below 1 .56 V. This is not 
an issue with respect to protecting the V cc since the 
on-chip protection blocks writes when V cc is below 3.0 V 
(XL2816A). 
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The ICL821 1 provides a simple and inexpensive solution 
to the problem of automating V cc level controlled 
inadvertent write inhibition. Intersil also offers a low 
power device which may be used in the same fashion. 
The Intersil ICL7665 is a Micropower Under/Over Voltage 
detector which performs just as the ICL821 1 yet utilizes 
less than 3 |xa of supply current (the ICL8211 specifies 
a typical value of 22 u.a). Each of these Intersil compo- 
nents are available in an 8-pin mini-DIP, the TO-99 can 
and as die. Please refer to the Intersil Data Book. 
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Figure 9b. ICL8211 Protection Waveforms 
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SGS L487 - Precision Voltage Regulator Solution 



Designs which utilize a local 5-V regulator are very simply 
write protected by replacing the standard regulator with 
the L487 from SGS, a precision 500 ma 5-V regulator 
which provides two extra pins. Figure 10a shows the 
implementation of the L487. The reset-output-pin is an 
open-collector driver which provides a low output 
whenever the output voltage of the regulator drops below 
4.859. When the output voltage is above the threshold 
voltage, the pullup resistor (R P ) holds 0~E high just as in 
the ICL821 1 example. The delay-capacitor-pin can be 
tied to a capacitor (C d ) to define a power-up delay, 



providing additional protection during power-up like that 
incorporated in the XL2816A on-chip protection 
mechanism. Figure 10b shows the corresponding 
waveforms. 

This solution is particularly attractive where board 
changes are to be avoided such as in the direct 
replacement of static RAMs or when an NMOS or TTL 
designer initially overlooked write protection for the 
XL2816A. The L487 may directly replace the existing 
regulator with the two additional pins wrapped up and 
appropriately connected via jumper wires! 



11 




MICROELECTRONICS. INC 

A SUBSIDIARY OF itAR CORPORATION 



AN-2 



RAW DC 
IN 

O 



(OPTIONAL) 



100 nF 




SYSTEM V cc 



OE 



SYSTEM 
BUS 



Figure 10a. External Protection Circuit 
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Figure 10b. SGS L487 Protection Waveforms 



TL7705A - Supply Voltage Supervisor 

The latest monolithic external inadvertent write solution 
from Texas Instruments is shown in Figure 1 1 . This 
device performs the same function as the ICL821 1 ; 
however, the trip voltage is internally preset, eliminating 
the requirement for external resistors in the design. The 
open-collector RESET output controls OE just as in the 
previous examples. This output is specified to be low 
whenever V cc is between 3.6 and 4.5 V. This can leave 
the device vulnerable in the range from 3.0 V, where the 
XL2816A internal protection takes over, and 3.6 V, where 
the TL7705A cuts in. Texas Instruments is currently 
developing an applications note to assist designers with 
this problem. Please contact Texas Instruments for 
current information. 



Filtering Control Signals 

If inadvertent write signals are occurring as a combination 
of spikes or glitches, the simple RC network shown in 



12 



MICROELECTRONICS. INC 

A SUBSIDIARY Of CIAR CORPORAIlOS 



AN-2 



FUNCTIONAL BLOCK DIAGRAM 

„ (8) 



TL7705A 



REFERENCE 
VOLTAGE 



Ct 



(3) 



SENSE (7) 
INPUT 



7.8 Kfi 



10 Kn 



RESIN 



(2) 



GND 



(4) 



100 [xA 



JT 





(6) 



(5) 



RESET 



RESET 



ReSinQ 



1 w 


8 


□ V cc 


2 


7 


SENSE INPUT 


3 


6 


J RESET 


4 


5 


RESET 



(1) 



REF 



Figure 11. Texas Instruments Integrated Solution 



Figure 1 2 will eliminate them by requiring extended pulse 
widths on the system bus to charge (or discharge) C d 
before the signal is passed through to the E 2 PROM 
control pin. The diode serves to prevent the WE pin from 
being subject to negative voltage if V cc drops to zero 
quickly. Note that this simpl e and inexpensive approach 
will increase the minimum WE pulse width which the 
system must supply during a write cycle. Slower systems 
will easily accommodate this constraint. However, high 
performance systems with normally short write pulse 
widths will require special consideration to successfully 
implement this solution. 
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Figure 12. WE Pulsewidth Filter 



READ CLK ■ 







E 2 PROM 






Ao 
A, 


CLK 








BINARY 
COUNTER 


• 
• 


A 2 


RESET 


• 


A N 





COUNTER 

RESET ■ 
CONTROL 



T 



Figure 13. Byte 000 Sacrifice Method 



Byte Sacrifice 

One clever solution to the inadvertent write concern is 
shown in Figure 13. The system for which this was 
implemented was a message display unit which used a 
counter to sequence up through the memory array 
reading out the message to be displayed. During power 
transitions, the address lines are held at zero through 
the counter reset mechanism. Although inadvertent write 
cycles are not inhibited, any unintended data changes 
are directed to address zero, which is disregarded during 
normal system operation. 
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Plug-In Memory Cartridge Applications 

The zero-power storage capability of E 2 PROMs makes 
them ideal for memory cartridge applications. Sporadic 
signals are inevitable during the physical cartridge 
insertion into a "hot" socket. To protect the E 2 PROM data 
integrity in such an environment the control pin contacts 
may be recessed so that they connect last during 
insertion and disconnect first during removal. Figure 14 
shows the connection layout which ensures that the 
memory is powered up with the control pins held to V cc 
or V ss via R P to violate the write condition until the active 
system takes control. 
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Figure 14. Hot Socket Cartridge Insertion 
Inadvertent Write Protection 
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One other concern with cartridge applications is the threat 
of Electro-Static Discharge (ESD) damage while the 
cartridge is unsocketed. To limit the potential voltage and 
current surges applied to the E 2 PROM inputs, current 
limiting resistors and input protection diodes are 
recommended as shown in Figure 1 5a. Figure 1 5b shows 
these diodes being replaced by a single Zener diode as 
an alternate solution. In either case, design consideration 
must be given to the magnitude of anticipated ESD 
voltages in selecting the value of the limiting resistors as 
well as in choosing diodes with the surge current 
capacities and switching speeds necessary. The input 
itself may be simply modeled as a 1 pF capacitor as in 
Figure 15c. 
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Figure 15. E 2 PROM Cartridge Applications 
ESD Protection 
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Summary: Off-Chip Write Protection Circuits 

The inadvertent write protection features designed into 
each of the various EXEL E 2 PROMs may be supple- 
mented by external protection when design concerns 
warrant it. The three-line control bus architecture makes 
the inhibition of write cycles easy to implement and 
several suggestions have been offered to manage the 
control lines during critical periods: 



• A hardware switch may be used in write-rarely 
firmware applications. 

• Fully automated control can be designed by using 
one of several off-the-shelf supply-voltage monitoring 
circuits. 



• Inadvertent write commands generated by short 
duration pulses may be eliminated by filtering control 
signals through a small RC filter. 

• E 2 PROM cartridge designs may be hot socketed 
without risking either data integrity or device reliability 
when some simple design constraints are observed. 



The circuit examples shown do not include any of the 
many discrete component approaches nor do they 
exhaust the possible integrated solutions. They do, 
however, cover a wide range of options and clearly reveal 
the many directions a system engineer might look to 
provide an E 2 PROM design that offers cost effectiveness 
and design ease as well as freedom from data integrity 
concerns. 
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POWER CRASH! 

Once unintentional write commands have been eliminated 
either through EXEL's advanced on-chip protection or 
through one of the external solutions, the data stored in 
the nonvolatile array is secure. Having thought the 
problem through to this degree of understanding, one 
issue frequently arises as a question (and a good one 
at that) yet rarely is an actual problem: 

What If the Power Fails During the 10 ms 
Nonvolatile Write Cycle? 

The answer tends to be quite favorable in the vast 
majority of systems. It turns out that due to the system 
capacitance, the actual power-down time is many, many 
times longer than the 10 ms required to complete the 
nonvolatile write cycle. Consequently, in the unlikely 
event of a power failure occurring while a nonvolatile 
write cycle is in progress, the write cycle would most 
probably complete long before the power supply drops 
to V w ,. On EXEL E 2 PROMs, V w , is the point below which 
the on-chip charge pump is disabled and any write cycle 
in progress is aborted. The possibility exists that a 
nonvolatile write cycle could be initiated as power is 
falling off and approaching V W! . In this case the cycle 
would be aborted during execution. 

Small systems which have very little capacitance might, 
however, have the V cc roll off in less than 10 ms. It is 
useful, therefore, for designers to have insight into the 
potential hazards of power-crash aborted nonvolatile 
write cycles. Figure 16 shows the internal sequence of 
events and approximate timings of each. The internal 
charge pump is disabled whenever V cc s= V W! , so the 
sequence will run its course until the V W | threshold is 
crossed. After this time, there is no longer the high 
voltage present which- is necessary to cause nonvolatile 
data alterations. 



Only the Byte (or Page) Being Operated 
Upon is At Risk! 

Many of the competing E 2 PROM manufacturers will not 
guarantee any particular performance, or resultant data 
pattern, if power fails during a nonvolatile write cycle. 
They say that the final data (throughout the array) is 
unpredictable, rendering such a situation to be (as far as 
the data is concerned) a catastrophic failure. They also 
say that they are not responsible since you are operating 
their device in an out-of-spec application. 

EXEL memory designers took this problem into account 
during the design phase to ensure that only the 
addressed locations would be affected by a power failure 
when a write cycle is in progress. To accomplish this, 
they ensured that both the data and address latches 
operate reliably until V cc is well below V w ,. 

Figure 1 7 shows a simple circuit which may be used to pro- 
vide power to the E 2 PROM to make sure that nonvolatile 
write cycles are completed even if interrupted by a power 
failure. The capacitor is charged up to 5 V during normal 
power-up and steady state operation. Once power fails, 
the super capacitor discharges through the E 2 PROM, 
providing l cc for 1 ms so that the nonvolatile write cycle 
may be completed. Note that this design renders the 
on-chip V cc lockout protection circuit useless during any 
power-down phase since the E 2 PROM V cc will lag the 
system V cc . This particular approach would be ideally 
suited to the XL28C256 due both to its sophisticated 
software controlled inadvertent write protection and to its 
low power consumption. 
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Figure 17. Power Crash Protection 



EXAMPLE (XL28C256): 

1) Recall I = C dv/dt 



2) Use 



3) Use 



4) Use 



I - 'ccw 

(max current during nonvolatile write cycle) 
l max = 60 mA 

dV = (Vsyst - V D1 ) - 4.5 V 

where: (V SYS t - V D1 ) is V cc at the 
start of crash 

4.5 V is the minimum specified 
operating voltage 

V D1 = .2 V (germanium) 

dt = t NW = 10 ms 



5) Solve for d 
C, 

c 1 



= I dt/dV 

= 60 mA * 10 ms / 300 mV 
= 2000 |xF 
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Figure 18. Power Status Conditioned WE Signal 



Power Status Conditioned Write Signal 

Another approach to the remote hazard of a power-down 
during a write cycle is to condition the initiation of write 
cycles with power status information. For example, Figure 
1 8 shows the WE signal from the control bus conditioned 
by the presence of AC at the power supply input. If the 
AC is not present then the write cycle will not be initiated 
and if it is present then a write cycle will have time to 
complete since, if the AC failed in the next moment, the 
system capacitance would carry the nonvolatile write 
cycle to completion. This AC signal could also be tied to 
an interrupt which initiates a power-crash routine and 
prevent nonvolatile write cycles through software. 



17 



SUMMARY 



The design hazard known as inadvertent writes or false 
writes has plagued system designers since the advent of 
the first alterable nonvolatile memory devices. Though at 
first thought to be a technology problem with E 2 PROMs, 
inadvertent writes turn out to be an easily managed 
system phenomenon. 

EXEL Microelectronics has developed a wide range of 
highly versatile E 2 PROMs which incorporate varying 
degrees of on-chip inadvertent write protection. For each 
of these features, the functional description, system 
advantages and disadvantages, as well as successful 
design-in strategies have been covered. 

Particular system constraints or requirements may 
necessitate the use of external power-up/down protective 
circuitry. This application note has covered the application 
of many methods of inadvertent write protection from a 
simple hardware switch to fully automated protection 
integrated by a variety of manufacturers. 

Inadvertent writes and the associated data uncertainty 
has been overcome and this applications note reveals all 
the information required to eliminate them as a data 
hazard. With this freedom, design engineers can return 
their attention to the power which E 2 PROM technology 
affords them in their designs, in their system applications 
and ultimately to the exciting advantage which is gained 
in the marketplace by systems utilizing in-system alter- 
able nonvolatile memory. 
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APPENDIX A: 
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Figure A. Troubleshooting Test Setup 



TROUBLESHOOTING INADVERTENT 
WRITE COMMANDS 

The elimination of inadvertent write commands in a 
system with operational hardware may require pinpointing 
and identifying their occurrence. They often have a 
random nature which can frustrate even the best 
debuggers. Fortunately, there are two simple ways to find 
them, as this Appendix reveals. 

Protecting E 2 PROM Endurance 

Since the inadvertent write phenomenon occurs on the 
system bus independently of the E 2 PROM, unnecessary 
memory write cycling may be prevent by removing the 
device from its socket during the testing procedure. 
In systems where the E 2 PROM data is required for 
system operation (i.e., control store programmed into the 
E 2 PROM), you may eliminate any write cycles from 
altering the E 2 PROM data by bending the WE pin up out 
of the socket and tying it to V cc via a pullup resistor. 
This allows the E 2 PR0M to be read while preventing any 
data alterations. 

Logic Analyzer Method 

Pinpointing inadvertent write commands can be easily 
accomplished through the use of an advanced logic 
analyzer by connectingit to the control bus which 
operates the E 2 PROM OE, C"E, and WE pinsJ3y setting 
the trigger condition to be (OE ss V, H ) • (CE =s V, L ) • 
(WE =s V, L ), the logic analyzer will trip whenever a valid 
write command is encountered on the system bus. 



Procedure 

1 . Allow the system to operate in a region of control 
store where no E 2 PROM write commands are issued 
(i.e., an endless loop performing some other function). 

2. Switch the system on and off several times, watching 
for the logic analyzer to trigger. This will cycle the 
test system circuitry through its power-up and 
power-down transitions, while you watch for unin- 
tended write commands to trigger the logic analyzer. 

3. If many on/off cycles do not provide a valid write 
command, you may want to implement a clock to 
control the system power supply, switching it on and 
off every several seconds and letting it run over an 
extended period. Inadvertent write commands on the 
control bus may be due to random signals and bus 
contentions which only produce a valid write 
command once in many, many power transition 
cycles. To ensure a reliable system design without 
providing additional hardware protection, it is 
important to cycle several system samples exten- 
sively, while monitoring the control bus for hazards. 



If any inadvertent write commands is observed, you can 
zero in on its timing and source by repeating the cycling 
while systematically reducing the logic analyzer ranges. 
Once the problem and its timing is pin-pointed, an 
appropriate protection mechanism may be implemented 
to block it. When this protection installation is complete, 
repeat the cycling until you are confident that the problem 
has been eliminated. 
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Figure B. Circuit Recognizes Control Bus V cc Conditions Which Could Initiate a Nonvolatile Write Cycle 

"NOTE 1 : Vthreshold = Input level trip voltage which changes output state. 

Vthreshold = (Rl + R2) (1.15 V) 
"1 

*NOTE 2: RC Filter is adjusted to block WE low pulses of =s20 ns duration; use pulse generator and scope to trim Ft 3 . 



Write Command Detector/Counter 

In the absence of a sophisticated logic analyzer, a simple 
circuit can be built to detect and count valid write 
commands issued to the E 2 PROM. Figure B shows a 
logic configuration which emulates the E 2 PROM's 
internal protection mechanisms to avoid counting write 
cycles which would be blocked out by the integrated 
protection and counts only those which might initiate a 
nonvolatile write cycle, causing nonvolatile data changes. 

The counter will advance whenever a valid write 
command is detected. 

Valid write command = (OEsV„)-(CEs V lu ) • (WE s V, L for a 20 ms) • ( V cc s Vth,, ES hold) 



Pm is adjusted to set the ICL821 1 threshold voltage to a 
desired level (3.0 V for XL281 6, 4.0 V for XL2864A, etc.). 
This threshold voltage may also be systematically varied 
so that the voltage at which the problem write cycles 
begin can be determined. 

ECL or equivalently fast components should be used in 
building the detector to ensure recognition of short (20 ns) 
pulses. Use a separate 5 V supply, so that the detector/ 
counter circuitry will operate reliably while the test system 
power supply is cycled on and off. 

The detector/counter is used by conne cting the clip 
contacts to the V cc , V ss , OE, CE and WE pins on an 
in-circuit E 2 PROM. The system is run and its power cycled 
while the counter is monitored for E 2 PROM write 
commands. If the detector counts more write cycles than 
the system software is intended to issue, then either a 
software bug or hardware hazard is indicated. 
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APPENDIX B : 

OFF-CHIP SOLUTIONS - PRICES AND CONTACTS 





Temperature Range 


Approximate 
Commercial 
100 Piece Price 


Standard Package Types 
Offered 


Commercial 


Industrial 


Military 


ICL8211 


Yes 


Yes 


Yes 


$1.30 


TO -99 Die 
8-Pin SO 
8-Pin Epoxy DIP 


ICL7665 


Yes 


Yes 


Yes 


$2.50 


SGS L487 


Yes 


Yes 


Yes 


$2.40 


T0-240/Pentawatt 
8-Pin DIP 


TL7705A 


Yes 


No 


No 


$1.50 



Intersil, Inc. 

10710 N. Tantau Avenue 
Cupertino, California 95014 
Telephone: (408) 996-5000 
TWX: 910-338-2014 

SGS-ATES Semiconductor Corporation 

1000 E. Bell Road 
Phoenix, Arizona 85022 
Telephone: (602) 867-6275 
Telex: 249976 

Texas Instrument Semiconductor Group 

P.O. Box 225012 
Dallas, Texas 75265 
Telephone: (214) 995-2011 
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